Privacy policy

DepotProof ("we", "us") is a condition-report service for equipment hire businesses. This policy explains what personal information we collect, what we do with it, where it lives and how to reach us about it. It is written in plain language on purpose; if any of it is unclear, write to help@depotproof.com.

We handle personal information in line with the Australian Privacy Act 1988 and the Australian Privacy Principles, and the New Zealand Privacy Act 2020, whether or not a particular exemption would otherwise apply to us.

Who this policy covers

Two groups of people appear in DepotProof.

Our customers are the hire companies and their staff who create an account and use the app. We collect their information directly and decide how it is used.

Renters are the people our customers hire equipment to. Their names, email addresses, signatures and the photographs of the machines they hire are recorded by the hire company, on the hire company's instructions, as part of the hire company's own records. We process that information on the hire company's behalf. If you are a renter and want to know what a hire company holds about you, ask the hire company; we will help them answer.

What we collect

From customers and their staff:

• Account details: your name, email address, role, and a password, which we store only as a one-way hash.
• Company details: the trading name, the copy address for emailed reports if one is set, a logo if one is uploaded, and the depot's time zone.
• Billing references: the customer and subscription identifiers our payment provider assigns, and the plan's status. We never see or store card numbers.
• Support and feedback messages you send from the app, with your name, email and company attached so we can reply.

From the use of the app, on the hire company's instructions:

• Handover records: the machine, the renter's name and optionally email, the photographs taken at pickup and return, the time each was taken, the damage note typed at return, and the renter's and the staff member's signatures.
• A position for each handover, taken from the phone when the handover is started, if the phone supplies one. The app asks once; if the answer is no, or the phone cannot supply one, the record says "Not recorded" and nothing else is tried.

Technical information:

• Server logs with the address, browser type and pages requested, kept for operating and securing the service.
• Analytics and advertising data through Google Analytics and Google Ads, described under Cookies below.

Why we use it

• To run the service: create accounts, record handovers, generate reports, and email a report to a renter when a staff member chooses to.
• To bill the subscription through our payment provider.
• To answer support requests and read feedback.
• To keep the service secure and working, including investigating errors.
• To understand how the website is used and whether advertising brings customers who sign up.

We do not sell personal information, and we do not use renters' information for anything other than producing the hire company's records.

Where the information lives and who handles it

We use a small number of providers to run DepotProof. Each holds only what its job needs.

Provider	What it does	Where
Vercel	Hosts the website and the application	United States, with a global network for delivery
Neon	Hosts the database of accounts, companies and handover records	Singapore
Linode (Akamai)	Object storage for photographs, signatures and generated PDF reports, in a private bucket	Singapore
Polar	Payments, invoices and subscription billing, as the merchant of record. Card details go to Polar and never to us	European Union and United States
Proton	Sends the email the service sends: reports to renters, and support messages to us	Switzerland
Google	Google Analytics and Google Ads, when enabled, for website analytics and advertising measurement	United States

Information is therefore stored outside Australia and New Zealand. We choose providers that publish their own security and privacy commitments, and we send each one only what its job needs.

Cookies and analytics

The application uses one essential cookie to keep you signed in. It contains a signed session reference and nothing else.

The public website may load Google Analytics and Google Ads tags. When they are enabled, Google sets cookies to measure page views and to attribute a signup or a trial to an advertisement. We use this to understand which pages and advertisements bring customers; Google's own privacy policy governs what Google does with the data. The application screens behind the login do not carry advertising tags.

How long we keep it

Handover records and reports are kept for as long as the hire company's account exists. They are the hire company's evidence, and evidence is only useful if it is still there when a dispute arrives months later. A hire company can ask us to delete its account and everything under it, and we will, subject to any retention the law requires of us.

Support and feedback messages are kept as ordinary business correspondence. Server logs are kept for a short operational period and then discarded.

Security

The site and the application are served over HTTPS only. Photographs and reports sit in a private bucket that nothing on the open web can read: the application fetches them itself and delivers them over your signed-in session. Uploads from the phone go directly to storage using signed, single-purpose addresses that expire. Passwords are hashed. Access to production systems is limited to the people who operate the service.

No system is perfect. If we become aware of a breach that affects you, we will tell you what happened and what we are doing about it, and we will meet the notification obligations that apply.

Your rights

You can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. Customers can read and change most of their own details in the app's Settings. Write to help@depotproof.com for anything else, and we will answer within 30 days.

If you are unhappy with how we have handled your information, tell us first and we will try to put it right. You can also complain to the Office of the Australian Information Commissioner (oaic.gov.au) or the Office of the Privacy Commissioner in New Zealand (privacy.org.nz).

Children

DepotProof is a business service and is not directed at children. We do not knowingly collect information from anyone under 16.

Changes to this policy

We will change this policy when the service changes. The effective date at the top says when it last did. A change that affects how we use information you have already given us will be announced in the app before it takes effect.

Contact

Privacy questions, access requests and complaints: help@depotproof.com. Support requests are best sent from the Support screen inside the app, which attaches your account so we can find it.